I do agree with @jaytee comment. The only thing that I will change, is the logic around files.
I will set a time limit for downloading a file - x days/hrs and then I'll set up a job that will check for example every x hrs or once a day if there's any file (zip) that is older than x day/hrs and if it is, then delete it.
This is a much better approach in my opinion because you don't have to care if user cancel (breaks) the download process in the browser.
I had such a strategy. Until Google began to sort out the download links and the server did not run out of free space. After that I had to review the business process and prohibit downloading not for an authorized user